SSL Certificate Checker, Inspect a PEM Cert & TLS Best-Practice Checklist
Paste an X.509 certificate to read its fingerprints, DNS names and recovered identity strings, then run down a battle-tested TLS/SSL hardening checklist: all decoded locally in your browser, so private certs never leave your machine.
What is the ssl certificate checker?
The SSL Certificate Checker decodes a pasted PEM/X.509 certificate to compute SHA-1 and SHA-256 fingerprints via Web Crypto, and recovers its SAN DNS names and Common Name candidates. It pairs this with a copy-ready TLS/SSL hardening checklist and openssl commands. Free and browser-based, so private certs never leave your machine.
The GigAI SSL Certificate Checker is an honest, in-browser certificate inspector and HTTPS hardening companion. Paste a PEM block (the `-----BEGIN CERTIFICATE-----` … `-----END CERTIFICATE-----` text) and it decodes the Base64 to raw DER, computes exact SHA-1 and SHA-256 fingerprints with the browser's own Web Crypto engine, reports the DER byte length, and recovers the printable identity strings inside, surfacing the Subject Alternative Name DNS entries and Common Name candidates so you can confirm which hostnames a certificate actually covers. Because a web page has no way to open a TLS socket to a remote server, and we intentionally ship no backend to do it for you, the tool never pretends to run a live handshake: instead it gives you what the pasted certificate genuinely contains plus a curated, copy-ready TLS/SSL best-practice checklist covering chain completeness, expiry and renewal, SAN hostname matching, protocol and cipher strength, HSTS, OCSP stapling, key size and the HTTP→HTTPS redirect: each with the exact openssl or nmap command to verify it yourself. Everything runs on the certificate you paste, so it is safe for internal PKI, staging certificates and keys you would never send to a third-party scanner. Close the tab and every byte is gone.
- Difficulty:
- Easy
- Typical time:
- ~30s
- Processing:
- 100% browser processing
Last updated
How to use the ssl certificate checker
- 1
Get the certificate in PEM form
Export it from your host or fetch it with `openssl s_client -connect example.com:443 -showcerts`, or open the.pem/.crt/.cer file. You want the text block from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE-----.
- 2
Paste it into the checker
Drop the PEM into the box (or use the sample). It's decoded and hashed instantly in your browser. Nothing is sent anywhere.
- 3
Read the fingerprints & hostnames
Confirm the SHA-256 fingerprint matches what you expect, and check the recovered DNS/SAN names cover every hostname the certificate must serve.
- 4
Work through the TLS checklist
Go down the hardening list and run the verify command beside each item against your live server to close any gaps the pasted certificate can't show.
What SSL Certificate Checker includes
Exact SHA-1 & SHA-256 fingerprints
The pasted PEM is decoded to raw DER and hashed with the browser's native Web Crypto, so the colon-separated SHA-1 and SHA-256 fingerprints match exactly what openssl and your certificate store report.
Recovered DNS names & SAN hosts
The tool pulls the printable strings out of the DER and highlights the Subject Alternative Name DNS entries and Common Name candidates, so you can confirm precisely which hostnames the certificate is meant to cover.
Complete TLS/SSL hardening checklist
A curated best-practice list, chain, expiry, SAN match, TLS 1.2+/1.3, strong ciphers with forward secrecy, HSTS, OCSP stapling, key strength and HTTP→HTTPS redirect, each with the exact command to verify it.
Honest about live scanning
No fake handshake. A browser can't open a TLS socket and we run no proxy, so the tool decodes what your pasted certificate actually contains and points you to the right server-side command for a live probe.
Private by design, nothing uploaded
Every byte is decoded and hashed locally in your browser, making it safe for internal PKI, staging certificates and material you'd never send to a third-party online scanner.
Copy fingerprints, export a report
Copy any fingerprint or DNS name with a click, load a real sample certificate to explore, and export the full parsed result plus checklist as a text report for a ticket or audit trail.
Why use our ssl certificate checker
Confirm you pasted the right certificate
Fingerprints and recovered hostnames let you match a PEM against what's deployed, pin a certificate, or verify a renewal is the intended cert before you roll it out.
Harden HTTPS without memorising openssl
The checklist turns a decade of TLS lore (SANs over CN, TLS 1.3, forward secrecy, HSTS preload, OCSP stapling) into concrete steps with the exact command for each, so nothing important slips.
Inspect certificates you can't upload
Internal, staging and client PKI certificates stay on your machine because parsing is 100% local. No third-party SSL scanner ever sees the bytes.
Understand the limits, honestly
You always know exactly what's exact (fingerprints, DER length, recovered strings) versus what needs a full ASN.1 parser or a live handshake. No guesswork, no fabricated fields.
Built for the way you work
From quick one-off fixes to daily workflows, see how people put this tool to use.
- DevOps / SRE
Verify a renewal before deploy
Paste the freshly issued certificate, confirm its SHA-256 fingerprint and SAN list are what you expect, then use the checklist to double-check chain order and stapling before pushing it to production.
- Security engineer
Audit an internal PKI certificate
Inspect a certificate from an internal or air-gapped CA that must never touch a third-party scanner: fingerprints and hostnames are recovered entirely on your machine.
- Web developer
Debug an HTTPS misconfiguration
Confirm the certificate you're serving actually lists the hostname in its SAN block, then walk the checklist to find the missing redirect, weak protocol or absent HSTS behind a browser warning.
- IT / support
Match a certificate to a fingerprint
When a vendor or monitor reports a certificate by fingerprint, paste the PEM here to generate the same SHA-1/SHA-256 values and confirm you're looking at the identical certificate.
Supported formats
Accepts PEM certificate and X.509, and produces Fingerprints, DNS names and Text report, all processed locally in your browser.
- PEM certificate
- X.509
- Fingerprints
- DNS names
- Text report
Frequently asked questions
Recommended tools
Security Header Checker
Paste your HTTP response headers and get an instant A–F security grade with per-header pass/warn/fail verdicts and copy-ready fixes for HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, 100% in your browser.
HTTP Header Checker
Paste raw HTTP response headers to parse them into a clean table and get instant notes on status, redirects, caching, compression, cookies, CORS and a graded security-header report, 100% in your browser.
Meta Tag Analyzer
Paste a page's HTML to audit its title, description, canonical, robots, Open Graph and Twitter Card tags: with a length score, missing/duplicate checks and a live search & social preview, 100% in your browser.
JSON Formatter
Format, validate and minify JSON in your browser with pinpoint error line + column, jump-to-error, key sorting and live editing: nothing is uploaded.
URL Encoder
Percent-encode text and URLs instantly: pick component mode for query values or full-URL mode to preserve structure, with a per-line batch switch. 100% in your browser, nothing uploaded.
CSP Generator
Build a correct Content-Security-Policy header from a friendly per-directive form (script, style, img, connect, font and frame sources) with a plain-English explanation and a live strictness meter. 100% in your browser.
Common problems, solved
Hit a snag? Here are quick fixes for the issues people run into most.
It says no PEM certificate was found.
Make sure you pasted the full block including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines. A bare.der/.crt binary or a private key won't work, export the certificate in PEM (Base64) form, e.g. `openssl x509 -inform der -in cert.der -out cert.pem`.
Why don't I see the expiry date, issuer or key size?
Those live in the certificate's ASN.1 structure, which needs a full X.509 parser we intentionally keep out of the bundle to stay small and fast. The fingerprints, DER length and recovered hostnames are exact. For validity dates and key size run `openssl x509 -noout -text -in cert.pem` locally.
Can it check a live website's certificate by URL?
No. A browser can't open a raw TLS socket to another host, and we run no server to do it for you. That's why this is a paste-a-cert tool. Grab the live cert with `openssl s_client -connect host:443 -showcerts` and paste it, or use a server-side scanner for a full handshake report.
The recovered strings include some odd fragments.
Recovered strings are printable byte runs pulled straight from the DER, so alongside real hostnames and org names you may see OIDs or encoding artefacts. The DNS names and Common Name lists are filtered to valid host patterns. Treat the raw strings as a best-effort peek, not a decoded field list.
Get the most out of it
Compare the SHA-256 fingerprint here against the one your monitoring or vendor reports to be certain you're inspecting the exact same certificate.
Certificates now rely on the SAN list, not the legacy Common Name, confirm every hostname you serve appears in the recovered DNS names.
Automate renewal with ACME (Let's Encrypt) so a certificate never expires unnoticed. The checklist's expiry item shows how to read the dates.
Pair this with the Security Header Checker to verify your HSTS `max-age`, `includeSubDomains` and `preload` directives are set correctly.
To grab a live server's certificate for pasting: `echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509`.
What's new
Recent updates and improvements to the ssl certificate checker.
Initial release: paste-a-PEM decoding with exact SHA-1/SHA-256 fingerprints via Web Crypto, DER length, recovered DNS/SAN names and Common Name candidates, plus the full TLS/SSL best-practice checklist.
Added one-click copy for fingerprints and hostnames, a real sample certificate to explore, and a downloadable text report combining the parsed result with the hardening checklist.
Refined the DNS-name filtering to reduce DER artefacts and clarified the honest note on what full X.509 decoding and a live handshake require.
Keep exploring
Problems we solve
Definitions
From the blog
Explore categories
Common tasks
Your privacy is built in
Every certificate is decoded, hashed and inspected locally in your browser using its native Web Crypto and Base64 decoders: nothing you paste is ever uploaded, stored or logged. Internal PKI certificates, staging material and confidential hostnames stay on your device, and closing the tab erases them completely.
- Runs in your browser
- No uploads
- Nothing stored
Ready to try the ssl certificate checker?
Free, private and instant. SSL Certificate Checker runs right in your browser.